Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!eternal-september.org!feeder.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail From: =?UTF-8?B?Sm9zaHVhIENyYW5tZXIg8J+Qpw==?= Newsgroups: comp.lang.java.programmer Subject: Re: Java vs JavaScript Date: Wed, 23 Apr 2014 15:48:49 -0500 Organization: A noiseless patient Spider Lines: 35 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Injection-Date: Wed, 23 Apr 2014 20:48:53 +0000 (UTC) Injection-Info: mx05.eternal-september.org; posting-host="8b6ddcc38ecbed2f71b30fabadb8aa0b"; logging-data="29401"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX18xXMVp0n3/PqBXWyqkr9Fwg45uC9vypy8=" User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Thunderbird/28.0 In-Reply-To: Cancel-Lock: sha1:mcakduEn0T/i3h46nTWR5rByitc= Xref: csiph.com comp.lang.java.programmer:28205 On 4/23/2014 10:39 AM, Roedy Green wrote: > There is something odd going on. > > I have always thought the Java sandbox was so restrictive, there was > nothing a user need worry about. There is no way an unsigned applet > could do any damage. Unless the Java VM and/or runtime had security holes. > On the other hand I don't think JavaScript has any sort of sandbox at > all, and everyone blissfully runs scripts that can do anything. "anything" is a bit of a misnomer here. The standard JavaScript runtime profile doesn't allow you to: 1. Access the local filesystems 2. Spawn, communicate, or interact with other processes 3. Open generic network sockets 4. Execute arbitrary native code All of these are possible with part of the standard Java library. In general, the security model of Java appears to me to be more of an afterthought, with ad-hoc securing of APIs. In contrast, the development of JavaScript has tended towards not admitting new APIs until after security reviews have been done on the APIs. Legacy APIs can be problematic sometimes, but the mighty hammer of things like CORS or CSP has reduced the scope of problems here. Certainly, in the past several months, the browser developers appear to have been taking security more seriously than Oracle has with Java. -- Beware of bugs in the above code; I have only proved it correct, not tried it. -- Donald E. Knuth